[!WARNING] The pam_shim is POC code, so be careful with using it on your own machine. Use it at your own risk.

The problem

At work I have to use Ubuntu but I want to share my nix config between all my devices i.e. desktop and work laptop. On my home setup I have been using Niri with Noctalia shell (quickshell) on NixOS. Everything works fine I can use the Noctalia shell lock screen and can authenticate fine.

However when I tried to do that on my Ubuntu machine, it wouldn’t let me log back in after locking the screen. Remember everything is installed via Nix (home-manager).

PAM

PAM is Linux’s standard authentication framework. When you lock your screen and type your password, PAM handles the authentication logic. It’s called “pluggable” because system administrators can configure different authentication methods (passwords, fingerprints, smart cards) without modifying applications.

PAM & Nix

Nix packages are completely self-contained. When you install a package with Nix, it includes all its dependencies in /nix/store/. But this creates a problem with PAM:

NixOS

Application → /nix/store/xxx-linux-pam/lib/libpam.so.2
           → /nix/store/yyy-pam-modules/lib/security/pam_unix.so
           → /etc/pam.d/ (managed by NixOS)
           → Authenticate ✅

Ubuntu

Application → /nix/store/xxx-linux-pam/lib/libpam.so.2
           → /nix/store/yyy-pam-modules/lib/security/pam_unix.so (doesn't exist!)
           → /etc/pam.d/ (managed by Ubuntu, expects different paths)
           → Authentication FAILS ❌

So we are locked out “forever” until we reboot, obviously not great. I know I hit this issue before with Hyprland and hyprlock (or swaylock) and ended up installing them via apt and not Nix. But this time I wanted to avoid doing that. I came across this issue.

Solution

We can use pam_shim, which creates a translation layer we can use. Whilst not breaking Nix’s package isolation.

1. PAM Shim Library: pam-shim creates a wrapper library that intercepts PAM calls and redirects them to the host system’s PAM library (/lib/x86_64-linux-gnu/libpam.so.0 on Ubuntu)

2. Patching: The replacePam function uses patchelf to replace PAM library references in the QuickShell binary with the shim library

3. Runtime: When noctalia-shell’s lock screen tries to authenticate:

   • QuickShell calls PAM functions
   • Calls go through the shim library
   • Shim redirects to Ubuntu’s native PAM
   • Authentication works against Ubuntu’s PAM stack

QuickShell → pam_shim intercepts pam_authenticate()
        → fork() subprocess
        → exec /lib64/ld-linux-x86-64.so.2 (system dynamic linker)
        → loads /lib/x86_64-linux-gnu/libpam.so.0 (Ubuntu's native PAM)
        → reads /etc/pam.d/common-auth (Ubuntu's PAM config)
        → loads /lib/x86_64-linux-gnu/security/pam_unix.so (Ubuntu's PAM module)
        → checks /etc/shadow (system password database)
        → returns PAM_SUCCESS via IPC to pam_shim
        → pam_shim returns result to QuickShell
        → Authentication SUCCEEDS ✅

Fix

update flake.nix

# PAM shim for non-NixOS systems
# Using 'next' branch for full libpam.so.0 API coverage
pam-shim = {
  url = "github:Cu3PO42/pam_shim/next";
  inputs.nixpkgs.follows = "nixpkgs";
};

inputs.pam-shim.homeModules.default

In our non-NixOS system i.e. modules/roles/non-nixos.nix

# PAM authentication fix for non-NixOS
pamShim.enable = true;

And add this overlay for all quickshell packages (what Noctalia shell uses). This will also work with other quickshells like DankMaterialLinux.

# Override quickshell globally with PAM-shimmed version
nixpkgs.overlays = [
  (final: prev: {
    quickshell = config.lib.pamShim.replacePam prev.quickshell;
  })
];

Where you have your noctalia-shell Nix config defined, i.e. noctalia.nix.

# Noctalia shell with PAM shim for lock screen authentication
systemd.user.services.noctalia-shell = mkIf config.desktops.addons.noctalia.enable (
  let
    shimmedQuickshell = config.lib.pamShim.replacePam pkgs.quickshell;
  in
  {
    Service = {
      ExecStart = lib.mkForce "${pkgs.writeShellScript "noctalia-nixgl" ''
        export PATH="${pkgs.wlsunset}/bin:${pkgs.wl-clipboard}/bin:${pkgs.cliphist}/bin:${pkgs.coreutils}/bin:${pkgs.gnugrep}/bin:${pkgs.gnused}/bin:${pkgs.bash}/bin:/run/wrappers/bin:${config.home.profileDirectory}/bin:/usr/bin:/bin"
        exec ${config.lib.nixGL.wrap shimmedQuickshell}/bin/quickshell -p ${config.programs.noctalia-shell.package}/share/noctalia-shell
      ''}";
    };
  }
);

Appendix

• pam_shim Repository

As per some of my recent articles, you will be aware I am using Hyprland (tiling manager) on Ubuntu and managing the config using nix (home-manager). I was having issues where for some reason it wouldn’t set the PATH variable correctly.

On my NixOS machine, the following would be fine:

bind=,XF86AudioRaiseVolume,exec, volume --inc
bind=,XF86AudioLowerVolume,exec, volume --dec

However, on Ubuntu I needed to provide the full path:

bind=,XF86AudioRaiseVolume,exec, ${volume}/bin/volume --inc

So in the Hyprland config it would look like:

bind=,XF86AudioRaiseVolume,exec, /nix/store/q1wm84g65smaq4agq7zp40q57x3534ni-volume/bin/volume --inc

It was because the session was being started by GDM (gnome), and the PATH variable was not being set properly. In Wayland GDM picks up environment variables from ~/.config/environment.d/envvars.conf ¹ so we can add it here.

❯ bat ~/.config/environment.d/envvars.conf --plain
PATH="$PATH:/home/haseebmajid/.nix-profile/bin"

Replace haseebmajid with your username (or I guess $HOME should work). This means when we run scripts now, it will source them from this nix-profile folder. Where the binaries get symlinked, including the volume script above. So now you don’t need to specify the full path (though maybe you should 🤷)

Appendix

• Hyprland Config
• Reddit Thread
• Discourse Thread

So I had tried to work out how to install Hyprland on Ubuntu 22.04. I couldn’t make it work via Nix/Home-manager. There is this great gist for how to set it up on Ubuntu 23.04. However, some of the versions available to me in the Ubuntu repository didn’t match the versions required by Hyprland. Hyprland is bleeding edge and themselves say they do not officially support Ubuntu.

In that gist above, one of the comments ¹ mentions Pika OS which builds Debian packages for Hyprland (and all of it dependencies). So we can add Pika OS as one of our sources and install Hyprland. To achieve this, I downloaded the dists/lunar/pika-sources.deb (Where I assume Lunar is based on Lunar Lobster, Ubuntu 23.04).

First we can see what it is going to install and where, by doing:

dpkg -c ./pika-sources.deb

drwxr-xr-x root/root         0 2022-10-01 13:50 ./
drwxr-xr-x root/root         0 2022-10-01 13:50 ./etc/
drwxr-xr-x root/root         0 2022-10-01 13:50 ./etc/init.d/
-rwxr-xr-x root/root       247 2022-10-01 13:50 ./etc/init.d/calamares-sources-undo
drwxr-xr-x root/root         0 2022-10-01 13:50 ./etc/rc2.d/
drwxr-xr-x root/root         0 2022-10-01 13:50 ./etc/rc3.d/
drwxr-xr-x root/root         0 2022-10-01 13:50 ./etc/systemd/
drwxr-xr-x root/root         0 2022-10-01 13:50 ./etc/systemd/system/
-rw-r--r-- root/root       522 2022-10-01 13:50 ./etc/systemd/system/steam-repos-fix.service
drwxr-xr-x root/root         0 2022-10-01 13:50 ./usr/
drwxr-xr-x root/root         0 2022-10-01 13:50 ./usr/share/
drwxr-xr-x root/root         0 2022-10-01 13:50 ./usr/share/apt-pika/
drwxr-xr-x root/root         0 2022-10-01 13:50 ./usr/share/apt-pika/apt/
drwxr-xr-x root/root         0 2022-10-01 13:50 ./usr/share/apt-pika/apt/apt.conf.d/
-rw-r--r-- root/root       146 2022-10-01 13:50 ./usr/share/apt-pika/apt/apt.conf.d/99steam-launcher
drwxr-xr-x root/root         0 2022-10-01 13:50 ./usr/share/apt-pika/apt/keyrings/
-rw-r--r-- root/root      1744 2022-10-01 13:50 ./usr/share/apt-pika/apt/keyrings/pika-keyring.gpg.key
drwxr-xr-x root/root         0 2022-10-01 13:50 ./usr/share/apt-pika/apt/preferences.d/
-rw-r--r-- root/root       282 2022-10-01 13:50 ./usr/share/apt-pika/apt/preferences.d/0-pika-radeon-settings
-rw-r--r-- root/root        91 2022-10-01 13:50 ./usr/share/apt-pika/apt/preferences.d/1-pika-ubuntu-settings
-rw-r--r-- root/root       102 2022-10-01 13:50 ./usr/share/apt-pika/apt/sources.list
drwxr-xr-x root/root         0 2022-10-01 13:50 ./usr/share/apt-pika/apt/sources.list.d/
-rw-r--r-- root/root       274 2022-10-01 13:50 ./usr/share/apt-pika/apt/sources.list.d/system.sources
drwxr-xr-x root/root         0 2022-10-01 13:50 ./usr/share/doc/
drwxr-xr-x root/root         0 2022-10-01 13:50 ./usr/share/doc/pika-sources/
-rw-r--r-- root/root       617 2022-10-01 13:50 ./usr/share/doc/pika-sources/changelog.Debian.gz
drwxr-xr-x root/root         0 2022-10-01 13:50 ./usr/share/dpkg/
drwxr-xr-x root/root         0 2022-10-01 13:50 ./usr/share/dpkg/scripts/
-rwxr-xr-x root/root       516 2022-10-01 13:50 ./usr/share/dpkg/scripts/steam-launcher.sh
-rwxr-xr-x root/root       643 2022-10-01 13:50 ./usr/share/dpkg/scripts/steamdeps
lrwxrwxrwx root/root         0 2022-10-01 13:50 ./etc/rc2.d/S01calamares-sources-undo -> ../init.d/calamares-sources-undo
lrwxrwxrwx root/root         0 2022-10-01 13:50 ./etc/rc3.d/S01calamares-sources-undo -> ../init.d/calamares-sources-undo

The main file being sources.list.d/system.sources which will add the Pika repository a source to our (apt) package manager. So after we download the pika-source file, we can then do:

# Assuming you are in the folder where you downloaded pika-sources.deb
dpkg-deb --fsys-tarfile pika-sources.deb | tar xv
sudo xcp ./usr/share/apt/source.list.d/system.sources /etc/apt/sources.list.d/system.sources
sudo apt update
sudo apt install hyprland xdg-desktop-portal-hyprland -y

This will install Hyprland and the desktop portal, which will allow us to do things like screen share-specific windows on apps like Google Meet.

Finally, you can also remove the Pika sources because in my case it wanted to upgrade 1600 packages as it uses Ubuntu 23.04 as a base. So wants to update numerous packages. To achieve this we do: sudo rm /etc/apt/sources.list.d/system.sources.

That’s It! You should now have Hyprland installed and when you reboot, you should be able to select Hyprland in the GDM login screen, after selecting the user, click the settings and then select Hyprland. An example below showing different versions of Gnome.

²